If you are regulated by the National Data Commissioner (data custodians, accredited users and accredited data service providers), you must report any breaches of data shared under the DATA Scheme.
In addition, if you are an accredited user or accredited data service provider, you must report events and changes in circumstances to the National Data Commissioner that are relevant to your accreditation, including a data breach involving data shared outside of the DATA Scheme.
If a breach involves personal data, it falls under the Notifiable Data Breaches scheme, which requires that you notify affected individuals and the Office of the Australian Information Commissioner of eligible data breaches. A breach is eligible if it is likely to result in serious harm to an individual whose personal information is involved. If you are a Scheme entity and make a report to the Office of the Australian Information Commissioner, you must give the National Data Commissioner a copy of any eligible data breach statement.